Privacy Policy

Last updated: 30 August 2026

This Privacy Policy describes how Eduoxy (“Eduoxy”, “we”, “us”, or “our”), the operator of https://eduoxy.com, collects, uses, stores, and shares personal information when you use our school management software, websites, and related services (the “Services”).

Eduoxy is a cloud school-management platform. We also act as a Meta WhatsApp Tech Provider: schools may connect their own WhatsApp Business Account (WABA) so that fee reminders, attendance alerts, and similar school notices can be sent through the WhatsApp Business Cloud API. WhatsApp message usage is billed by Meta to the school, not by Eduoxy.

1. Who is responsible for your data

For information about your Eduoxy account (school registration, billing for the Eduoxy subscription, support tickets, and website enquiries), Eduoxy is the data controller.

For information that a school stores in Eduoxy about its students, parents, staff, and school operations, the school is the data controller. Eduoxy processes that information only to provide the Services to that school, on the school’s instructions.

For WhatsApp Business data processed when a school connects a WABA, the school is the controller of the messages it sends to parents and staff. Eduoxy processes WhatsApp connection data (such as encrypted access tokens and delivery status) to operate the integration. Meta Platforms, Inc. and its affiliates process WhatsApp data according to Meta’s terms and privacy policy when messages are sent or received through WhatsApp.

2. Information we collect

2.1 Account and school information

• School name, address, and contact details
• Administrator, teacher, parent, and student account names, emails, phone numbers, and login credentials (passwords are stored hashed)
• Subscription and billing records for the Eduoxy SaaS plan (separate from WhatsApp charges)
• Support and contact-form messages

2.2 School records (on the school’s instructions)

• Admissions, attendance, fees, exams, homework, timetable, and similar education records the school chooses to store
• Parent and student contact details used for school communication

2.3 WhatsApp / Meta integration data

When a school connects WhatsApp through Embedded Signup (Facebook Login):

• WhatsApp Business Account ID, phone number ID, and display phone number
• Encrypted API access tokens used only to send messages and manage that school’s WABA on the school’s behalf
• Message template names, languages, and mapping to school events (for example fee reminders)
• Message content the school instructs us to send, recipient phone numbers, and delivery status (sent, delivered, read, failed) from Meta webhooks
• Limited inbound message metadata if the school enables two-way features

We do not use school WhatsApp tokens to message anyone except as that school configures. Tokens are never sent to web browsers.

2.4 Technical data

• IP address, browser type, device information, and pages visited on eduoxy.com
• Cookies and similar technologies needed to keep you signed in and to understand basic site usage
• Application logs for security, debugging, and abuse prevention

3. How we use information

• Provide, host, and improve the school management Services
• Create and authenticate user accounts and role-based access
• Process Eduoxy subscription payments and send service notices
• Send school-configured notifications by email, SMS, or WhatsApp
• Connect and maintain each school’s WhatsApp Business Account via Meta’s APIs
• Detect fraud, secure the platform, and meet legal obligations
• Respond to support requests

We do not sell personal information. We do not use student or parent records for advertising. We do not use WhatsApp message content to train public AI models.

4. How we share information

We share information only as needed to operate the Services:

• Meta / WhatsApp: When a school sends a WhatsApp message or connects a WABA, recipient numbers, template parameters, and related metadata are transmitted to Meta so WhatsApp can deliver the message. Meta’s processing is described in Meta’s Privacy Policy and WhatsApp Business terms.
• Payment processors: Subscription payments may be handled by payment gateways the school or Eduoxy configures.
• Email / SMS providers: If the school enables those channels.
• Hosting and infrastructure: Cloud and database providers that process data on our instructions.
• The school: School administrators can access records for their own campus only. Schools cannot access another school’s data, WABA, or message logs.
• Legal: If required by law, court order, or to protect rights and safety.

5. Children’s information

Eduoxy is used by schools to manage education. Student records, including information about minors, are collected and used only because the school (or a parent/guardian acting with the school) enters or authorises that information for educational administration. We do not knowingly market to children or allow children to create an independent Eduoxy consumer account. Parents or guardians who want a student’s information corrected or deleted should contact their school first. The school can update or remove records in Eduoxy, or ask us to assist.

6. Cookies

We use essential cookies for login sessions and security. We may use limited analytics cookies to understand how the public website is used. You can control cookies in your browser. Disabling essential cookies may prevent sign-in.

7. Security

We use administrative, technical, and physical safeguards appropriate to a multi-tenant school system, including:

• Hashed passwords and encrypted WhatsApp access tokens stored per school
• HTTPS in transit
• Role-based permissions so users see only what their school assigns
• Tenant isolation so one school cannot read another school’s records or WhatsApp logs

No method of transmission or storage is 100% secure. Please use a strong password and keep account access limited to authorised staff.

8. Retention

• School records are retained while the school’s Eduoxy subscription is active, and for a limited period afterwards if needed for backup, dispute, or legal reasons, unless the school asks us to delete them sooner where we can do so.
• WhatsApp delivery logs are kept to help the school troubleshoot sending and to meet operational needs, then deleted or anonymised on a rolling basis.
• Encrypted WhatsApp tokens are deleted when the school disconnects WhatsApp or when the school account is closed.
• Billing and legal records may be kept as required by applicable law.

9. Access, correction, and deletion

You may request access to, correction of, or deletion of personal information we hold, subject to the school’s role as controller for student/parent records and to legal exceptions.

• School users: Use your Eduoxy dashboard (profile, student, parent, and staff records) or ask your school administrator.
• Disconnect WhatsApp: A school administrator can disconnect the WABA in School Settings → WhatsApp Notifications. We then stop sending on that number and delete stored tokens.
• Close a school account: The school administrator or the person who registered the school may request account closure and deletion via our contact page.
• Public website / Meta app users: Email us using the contact details below and describe the Facebook or WhatsApp account involved. We will delete or disassociate data we control that is not required for legal or security purposes.

We will respond within a reasonable period. Where the school is the controller, we will direct you to the school or act on the school’s documented instruction.

10. International processing

Eduoxy may process information on servers in the country where we host the platform. If you access the Services from another country, your information may be transferred to that hosting location. We take steps appropriate to the context to protect that information.

11. Third-party services and links

The Services may link to school websites, payment pages, or Meta / WhatsApp pages. Those sites have their own privacy policies. Facebook Login and WhatsApp Embedded Signup are operated by Meta; when you complete that flow, Meta also collects information as described in Meta’s policies.

12. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change. The current version is always published at https://eduoxy.com/privacy. Continued use of the Services after an update means you accept the revised policy.

13. Contact us

For privacy questions, data-access requests, or deletion requests related to Eduoxy:

• Contact form: https://eduoxy.com/contact
• Website: https://eduoxy.com

Please include your school name, the email on the account, and a clear description of your request. For student records, contact your school as well so they can instruct us where needed.